WatchGuard FireWare OS: Directory Traversal in sigd Service…

A directory traversal vulnerability in the sigd service of WatchGuard FireWare OS allows an authenticated remote attacker to create arbitrary files. The flaw, tracked as CVE-2026-13054, carries a CVSS 4.0 score of 8.6 (HIGH) and can be chained with other vulnerabilities to achieve code execution as the samld user.

A directory traversal vulnerability in the sigd (signature daemon) service of WatchGuard FireWare OS allows an authenticated remote attacker to create arbitrary files on the target filesystem. Discovered by Nicholas Zubrisky of TrendAI Research and disclosed on July 29, 2026, via advisory ZDI-26-501, the flaw enables an exploit chain that can lead to code execution in the context of the samld user. The danger lies not in the single primitive — file creation — but in its ability to chain with other unspecified vulnerabilities to compromise the security perimeter of a critical asset.

Key Takeaways

CVE-2026-13054 carries a CVSS 4.0 score of 8.6 HIGH, with a network attack vector and high privileges required.
The flaw resides in the comp_start_cb function of the sigd service, where user-supplied paths lack validation during signature package archive extraction.
Affected versions include Fireware OS 11.0-11.12.4_Update1, 12.0-12.12, and the 2025.1-2026.2 releases.
The attack path requires authentication and chaining with other vulnerabilities to achieve code execution as the samld user.

The Flaw in the sigd Service: How the Mechanism Works

The sigd service handles digital signature operations on WatchGuard FireWare OS, the operating system powering the vendor's Firebox firewalls. According to advisory ZDI-26-501, the specific vulnerability lies in the comp_start_cb function and concerns the handling of signature package archives. The advisory text is explicit: "The specific flaw exists within the handling of signature package archives in the sigd service. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations."

The missing path validation allows an attacker to perform a path traversal, writing files outside the directories intended by the legitimate service flow. This arbitrary-write primitive does not constitute direct code execution on its own, but provides the initial piece of a broader kill chain. Persistence on the system and placement of files in strategic locations — unspecified in the dossier — form the basis for the documented escalation.

"An attacker can leverage this vulnerability in conjunction with other vulnerabilities to execute code in the context of the samld user." — ZDI Advisory ZDI-26-501

The Mismatch Between ZDI and CVE: sigd or Management Web UI?

A point of friction in the official documents concerns the exposed attack surface. Advisory ZDI-26-501 clearly identifies the sigd service as the location of the vulnerability, citing the comp_start_cb function and the handling of signature package archives. The CVE-2026-13054 record, however, describes the flaw as present in the "WatchGuard Fireware OS Management Web UI," with impact on "a privileged authenticated attacker" who can "write arbitrary files on the Firebox's filesystem."

This discrepancy does not call the vulnerability's existence into question — both sources converge on the directory traversal nature and arbitrary file creation — but raises an unanswered question: whether the web management interface directly exposes the sigd service, or whether two distinct attack vectors lead to the same result. The CVE mentions elevated privileges where the ZDI advisory speaks of generic authentication. The exact nature of the mismatch remains unspecified by available sources.

The Risk Profile: CVSS 8.6 and the Attack Vector

The official CVE record assigns the vulnerability a CVSS 4.0 score of 8.6, classified as HIGH. The full vector — AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — indicates a network attack with low complexity, but requiring high privileges (PR:H). This element reduces the exposure surface: the attacker must possess valid credentials. However, for organizations with over-privileged accounts, compromised passwords, or configurations exposing the management interface, the risk remains concrete.

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory — formally classifies the flaw's nature. The combination with other vulnerabilities for RCE as the samld user is particularly relevant: samld is the daemon managing SAML authentication on WatchGuard devices, a sensitive component interacting with the system's security core. Execution in this context could compromise not only the single device but the integrity of the federated authentication infrastructure linked to it.

Timeline and Patch Availability

Nicholas Zubrisky reported the vulnerability to WatchGuard on May 22, 2026. Coordinated disclosure occurred 68 days later, on July 29, 2026, with the publication of advisory ZDI-26-501 and the release of an update by the vendor. The interval between report and patch — just over two months — falls within typical coordinated disclosure windows, but does not include details on fixed builds or a specific URL for the official WatchGuard advisory.

The affected versions listed in the CVE record cover three main release lines: the 11.x series up to 11.12.4_Update1, the 12.x series up to 12.12, and the annual 2025.1-2026.2 releases. The absence of patch details in the ZDI advisory text leaves an operational gap: administrators must independently verify update availability through official WatchGuard channels.

What to Do Now

Verify the Fireware OS version running on managed devices and compare it against the affected releases listed in the CVE-2026-13054 record.
Apply the update released by WatchGuard, as indicated in advisory ZDI-26-501.
Review management interface and sigd service access logs for authentication anomalies or operations on signature package archives.
Audit administrative account privileges, limiting access to the minimum necessary.

Why Context Matters: Authentication Does Not Mean Harmless

The vulnerability requires authentication, an element that often leads to underestimating mitigation priority. That is a mistake. Firewalls are by definition perimeter devices, with management interfaces that — even if not directly internet-exposed — are accessible from internal network segments or via jump hosts. An attacker who has already obtained credentials through phishing, password reuse, or lateral movement finds in this flaw an accelerated path to perimeter control.

The documented chain — authentication, directory traversal, file creation, chaining with other vulnerabilities, RCE as samld — reflects a common pattern in modern offensives against network infrastructure. The single primitive is modest; the composition is lethal. For this reason, the CVSS 8.6 is not a measure of exploit immediacy, but of potential damage once attack conditions are met.

Frequently Asked Questions

Does the vulnerability allow RCE without authentication?

No. Advisory ZDI-26-501 specifies that authentication is required. Code execution additionally requires chaining with other vulnerabilities not detailed in the dossier.

Which versions need urgent updating?

According to the CVE-2026-13054 record: Fireware OS 11.0 through 11.12.4_Update1, 12.0 through 12.12, and releases 2025.1 through 2026.2.

Is a public exploit available?

The dossier does not report the presence of proof-of-concept or in-the-wild exploits.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references